1. Field of the Subject Disclosure
The present subject disclosure relates to mobile malware. More specifically, the present subject disclosure relates to detecting proximity-based mobile malware propagation.
2. Background of the Subject Disclosure
Mobile communication devices, such as cellular telephones, have become a common tool of everyday life. Cellular telephones are no longer used simply to place telephone calls. With the number of available features rapidly increasing, cellular telephones are now used for storing addresses, keeping a calendar, reading e-mails, drafting documents, etc. These devices are small enough that they can be carried in a pocket or purse all day, allowing a user to stay in contact almost anywhere. Recent devices have become highly functional, providing applications useful to business professionals as well as the casual user.
Proximity-based Mobile Malware Propagation (PMMP) is a category of malware that propagates through proximal connectivity such as WiFi, Bluetooth and infrared. The target victims are any communication device that has a WiFi, Bluetooth, IR, or any other module for proximal communication. These modules are now included in default configurations from many manufacturers. More risk exists for devices that are in “discoverable” mode, which broadcasts connection availability to all nearby devices. Also at risk are devices with either no password or PIN protection, or a weak one. Although slower than propagation schemes such as network-based instant messages and emails, proximity-based malware is compelling in its unique advantage that it is unobservable by the service provider network. Thus, it is substantially more challenging to detect proximity than network-based malware propagation.
Proximity-based propagation, by establishing short range wireless connection with victims, is a preferred method for mobile malware. Detection for proximity-based malware is still an open issue due to the fact that such malware has two main advantages compared to the network-based propagation. First, proximity-based propagation is difficult to detect since the communication between the attacker and the victims bypasses network-based security inspection. The provider network cannot observe any traffic or signals since such attacks launch locally. Second, proximity-based propagation is more likely to succeed due to the weak security in local connectivity technologies. Consequently, there is an increasing amount of mobile malware that propagates through proximity-based WiFi and Bluetooth connections. Well-known mobile malware that utilizes such vulnerabilities includes Lasco, Locknut, Cabir, ComWar, PBStealer, and Skuller. Given sufficient time, a Bluetooth malware can infect all susceptible devices in the network. Therefore, it is important to detect such activities locally and quickly.
Malware that uses PMMP can execute in three different ways. One way is through an established connection. If the victim device has already established connections with other devices, the attacker can utilize these established connections to infect other victim devices. Another way is to scan-connect. The attacker can actively scan and search for all the devices within the proximity. Then the malware will attempt to connect to these newly discovered devices and request to establish new connections. If these devices have no or weak passwords and PIN numbers, or if users acknowledge these connection requests, then these devices will be infected. One other way is to re-connect. If the victim device caches previously established connection settings, including security cookies such as password/PIN, then the attacker can avoid security challenges to establish connections and execute the propagation.
The victim device is a device that has been infected and controlled by the attacker to propagate the malware to other benign devices in proximity. Malware propagation through an established connection is difficult to detect. But the impact of such propagation is restricted in small local areas due to two aspects. First, assume that the mobile devices move frequently and that the average duration of an established connection is short. The probability that the victim device has a live connection when it is infected is very low. Second, the number of devices being infected through the established connection is also small, usually one device at a time. Thus, such propagation most likely will die out and impact only a few devices.
What is needed is a method of tracking PMMP in cases where the mobile device is infected without an active connection.